Setting for session.timeout not working for Admin user after upgrade to 4.19

[nxsbi]

ISSUE TYPE

• Bug Report

COMPONENT NAME

UI

CLOUDSTACK VERSION

4.19

CONFIGURATION

NA

OS / ENVIRONMENT

CentOS 7

SUMMARY

After upgrade to 4.19, my web UI Session timeout of 30 minutes seems to have no impact when logged in as the admin user. It works for other users. My /etc/cloudstack/management/server.properties file's setting session.timeout=30 - which used to work earlier and session timed out at 30 minutes of inactivity.
Additionally, I am able to close brower tab (in which I am logged in as admin), open a new tab with original URL (copy paste) and it still works without asking to log in as admin - that is a security risk in my mind.

STEPS TO REPRODUCE

From 4.17 upgrade to 4.19. Verify session.timeout=30 in server.properies file

EXPECTED RESULTS

Timeout occurs as per the /etc/cloudstack/management/server.properties file's setting session.timeout for all users including admin.

ACTUAL RESULTS

Timeout is not respected when logged in as admin. I left a session open overnight and I was able to start working without login need.
When logged in as non-admin user, the timeout setting works. 

[DaanHoogland]

@nxsbi , this is the unintended result of a new functionality; safe shutdown. It issues commands in the background when you are logged on. To test, you could close your tab/screen for the admin user for 31 minutes (more than the timeout at least) and than reopen it. You should then no longer be logged on.

Normal users don't have this functionality and hence their sessions timeout as before.

[nxsbi]

OK, thats good to know. I guess I just have to remember to log off :-)

[DaanHoogland]

Yeah :| I guess we can have a thought about a better solution. It was kind of an oversight but no-one has come up with another way to deal with it yet, @nxsbi . Solution could be to have a separate shutdown-app or a separate shutdown account or a switch to turn this behaviour on off (with it's own timeout). if you care to spend time on it we can leave this ticket open or cevert it to a discussion item...?

[DaanHoogland]

@nxsbi , can you check if this is still an issue on main (cc @sureshanaparti ) It may be solved with #9854